This pattern finds a parameter (sst) key + value in a GET request URL. When replaced with an empty string, effectively removes the parameter. Works with both full URLs and isolated query strings. Works in PCRE and PCRE2.

Full use case:

if (isset($_GET["sst"])) {

   // validate

   // modify active session

   $query = $_SERVER["REQUEST_URI"];
   $pattern = "/(sst=[^&]+&)|((\?|&|^)sst=[^&]+$)/";
   $uri = preg_replace($pattern, "", $query);

   unset($_GET["sst"]);

   header("location: https://example.com$uri", true, 308);
}